CVE-2026-54572

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.4

Description When using the -l/--links flag, the software serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target. This allows an attacker-controlled remote source to plant an escaping symlink, causing subsequent object writes to occur outside the intended destination directory with attacker-chosen contents.

Recommendations Update to version 1.74.4.